CN110490730B - Abnormal fund aggregation behavior detection method, device, equipment and storage medium - Google Patents
Abnormal fund aggregation behavior detection method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN110490730B CN110490730B CN201910775437.5A CN201910775437A CN110490730B CN 110490730 B CN110490730 B CN 110490730B CN 201910775437 A CN201910775437 A CN 201910775437A CN 110490730 B CN110490730 B CN 110490730B
- Authority
- CN
- China
- Prior art keywords
- node
- network
- sub
- fund
- nodes
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 230000002776 aggregation Effects 0.000 title claims abstract description 107
- 238000004220 aggregation Methods 0.000 title claims abstract description 107
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 69
- 238000001514 detection method Methods 0.000 title claims abstract description 48
- 238000003860 storage Methods 0.000 title claims abstract description 19
- 238000004422 calculation algorithm Methods 0.000 claims abstract description 45
- 238000000034 method Methods 0.000 claims abstract description 30
- 238000012545 processing Methods 0.000 claims abstract description 7
- 238000012546 transfer Methods 0.000 claims description 43
- 238000009825 accumulation Methods 0.000 claims description 19
- 239000011159 matrix material Substances 0.000 claims description 19
- 238000009826 distribution Methods 0.000 claims description 12
- 238000004364 calculation method Methods 0.000 claims description 9
- 238000004590 computer program Methods 0.000 claims description 5
- 230000006399 behavior Effects 0.000 abstract description 49
- 238000010586 diagram Methods 0.000 description 15
- 230000008569 process Effects 0.000 description 8
- 230000000694 effects Effects 0.000 description 6
- 238000010606 normalization Methods 0.000 description 6
- 230000000644 propagated effect Effects 0.000 description 4
- 238000000638 solvent extraction Methods 0.000 description 4
- 238000013016 damping Methods 0.000 description 3
- 230000002411 adverse Effects 0.000 description 2
- 238000010276 construction Methods 0.000 description 2
- 230000003993 interaction Effects 0.000 description 2
- 238000004900 laundering Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 206010000117 Abnormal behaviour Diseases 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000002860 competitive effect Effects 0.000 description 1
- 208000037265 diseases, disorders, signs and symptoms Diseases 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000012804 iterative process Methods 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 230000003595 spectral effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/02—Banking, e.g. interest calculation or account maintenance
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/10—Protocols in which an application is distributed across nodes in the network
Landscapes
- Business, Economics & Management (AREA)
- Engineering & Computer Science (AREA)
- Accounting & Taxation (AREA)
- Finance (AREA)
- Technology Law (AREA)
- Economics (AREA)
- Marketing (AREA)
- Strategic Management (AREA)
- Development Economics (AREA)
- Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
The application provides a method, a device, equipment and a storage medium for detecting abnormal fund aggregation behaviors, and relates to the technical field of data processing. The method comprises the steps of constructing a directed node network associated with a plurality of accounts, and dividing nodes in the directed node network into a plurality of sub-networks according to a preset algorithm; and then, acquiring transaction weights between accounts corresponding to each node in the sub-network, and calculating the fund aggregation degree of each node in the sub-network according to the transaction weights between the accounts corresponding to each node in the sub-network, so that whether a node with unbalanced fund flow direction exists in the sub-network can be judged according to the fund aggregation degree of each node in the sub-network, if the node with unbalanced fund flow direction exists, the account corresponding to each node in the sub-network can be considered to belong to an abnormal fund aggregation group, and the abnormal fund aggregation behavior detection aiming at the group property is realized.
Description
Technical Field
The application relates to the technical field of data processing, in particular to a method, a device, equipment and a storage medium for detecting abnormal fund gathering behaviors.
Background
The fund aggregation generally refers to a phenomenon that a large amount of funds are aggregated into one account, and part of the fund aggregation can be abnormal fund aggregation caused by illegal fund operation such as fraud, intermediary loan, money laundering and the like. The part of abnormal fund aggregation can cause certain adverse effect on social economy, so that the fund aggregation needs to be effectively detected in time so as to avoid the adverse effect on the social economy caused by the part of abnormal fund aggregation behaviors by adopting strategies such as fund transaction anti-fraud, anti-money laundering, abnormal fund monitoring after credit and the like.
Currently, the detection mode for abnormal fund aggregation behavior is generally as follows: and judging whether the single account has abnormal behaviors or not through a rule strategy so as to determine whether the fund transaction of the account is abnormal fund aggregation or not. For example, the rule policy may be generated by using the indexes of the account such as the transfer-in/out funds in a short time, the transfer-in/out frequency, the number of accounts transacted once, and the like as left variables, using the empirical threshold as right variables, and combining logical operators.
However, the above conventional detection method for abnormal fund aggregation cannot be applied to abnormal fund aggregation behavior detection for group.
Disclosure of Invention
The application aims to provide an abnormal fund aggregation behavior detection method, device, equipment and storage medium, which can be suitable for abnormal fund aggregation behavior detection aiming at group.
In a first aspect, an embodiment of the present application provides a method for detecting abnormal fund aggregation behavior, where the method includes:
constructing a directed node network associated with a plurality of accounts, and dividing nodes in the directed node network into a plurality of sub-networks according to a preset algorithm, wherein the directed node network comprises a plurality of nodes, each node corresponds to one account information, and directed edges in the directed node network are used for representing the fund flow direction between the connected nodes;
acquiring transaction weights between accounts corresponding to all nodes in a sub-network;
and calculating the fund aggregation degree of each node in the sub-network according to the transaction weight between the accounts corresponding to each node in the sub-network.
Optionally, after calculating the fund aggregation level of each node in the sub-network according to the transaction weight between the accounts respectively corresponding to each node in the sub-network, the method further includes:
and calculating and acquiring a balance index of the sub-network according to the fund aggregation degree of each node in the sub-network, wherein the balance index is used for indicating whether the fund aggregation degree distribution of each node in the sub-network is balanced or not.
Optionally, the calculating the fund aggregation level of each node in the sub-network according to the transaction weight between the accounts respectively corresponding to each node in the sub-network includes:
calculating the fund transfer probability of each node in the sub-network relative to other neighbor nodes according to the transaction weight between accounts corresponding to each node in the sub-network;
constructing a fund transfer matrix corresponding to the sub-network according to the fund transfer probability of each node in the sub-network relative to other neighbor nodes;
and calculating the fund aggregation degree of each node in the sub-network according to the page sorting algorithm and the fund transfer matrix corresponding to the sub-network.
Optionally, the calculating, according to the transaction weight between the accounts respectively corresponding to the nodes in the sub-network, a fund transfer probability of each node in the sub-network with respect to other neighboring nodes includes:
and carrying out normalization processing on the transaction weight between the accounts respectively corresponding to each node in the sub-network to obtain the fund transfer probability of each node in the sub-network relative to other neighbor nodes.
Optionally, the equalization index is a kuni coefficient or entropy.
Optionally, if the balance index is a kini coefficient, the calculating a balance index of a sub-network according to the fund aggregation of each node in the sub-network includes:
using a formula
Calculating the kini coefficients of the sub-networks;
wherein Gini represents the Gini coefficient, p j Indicating the fund accumulation degree of the j-th node in the sub-network.
Optionally, the constructing a directed node network associated with a plurality of accounts, and dividing the directed node network into a plurality of subnetworks according to a preset algorithm includes:
obtaining a flow of funds between a plurality of accounts;
constructing a directed node network associated with a plurality of accounts according to the fund flow direction among the plurality of accounts;
and dividing the directed node network into a plurality of sub-networks according to a preset algorithm.
Optionally, the dividing the directed node network into a plurality of sub-networks according to a preset algorithm includes:
according to a preset rule, each node in the directed node network is endowed with a label;
iterating all nodes in the directed node network by adopting a label propagation algorithm, and obtaining a plurality of sub-networks after preset iteration conditions are met; all nodes in each sub-network have the same label.
In a second aspect, an embodiment of the present application provides an abnormal fund accumulation behavior detection apparatus, including:
the node network module is used for constructing a directed node network associated with a plurality of accounts and dividing nodes in the directed node network into a plurality of sub-networks according to a preset algorithm, wherein the directed node network comprises a plurality of nodes, each node corresponds to one account information, and directed edges in the directed node network are used for representing the fund flow direction between the connected nodes;
the acquisition module is used for acquiring transaction weights among accounts corresponding to all nodes in the sub-network;
and the first calculation module is used for calculating the fund aggregation degree of each node in the sub-network according to the transaction weight between accounts corresponding to each node in the sub-network.
Optionally, the abnormal fund accumulation behavior detection apparatus further includes: and the second calculation module is used for calculating and acquiring a balance index of the sub-network according to the fund aggregation degree of each node in the sub-network, wherein the balance index is used for indicating whether the fund aggregation degree distribution of each node in the sub-network is balanced or not.
Optionally, the first computing module includes:
the probability submodule is used for calculating the fund transfer probability of each node in the sub-network relative to other neighbor nodes according to the transaction weight between accounts corresponding to each node in the sub-network;
the matrix submodule is used for constructing a fund transfer matrix corresponding to the sub-network according to the fund transfer probability of each node in the sub-network relative to other neighbor nodes;
and the aggregation degree sub-module is used for calculating the fund aggregation degree of each node in the sub-network according to the page sorting algorithm and the fund transfer matrix corresponding to the sub-network.
Optionally, the probability sub-module is specifically configured to perform normalization processing on transaction weights between accounts corresponding to each node in the sub-network, so as to obtain a fund transfer probability of each node in the sub-network relative to other neighboring nodes.
Optionally, the equalization index is a kuni coefficient or entropy.
Optionally, if the equalization index is a kini coefficient, the second calculating module is specifically configured to use a formula
Calculating the Keyny coefficient of the sub-network;
wherein Gini represents the Gini coefficient, p j Indicating the fund collection of the jth node in the subnetwork.
Optionally, the node network module includes:
the obtaining submodule is used for obtaining the fund flow direction among a plurality of accounts;
the construction submodule is used for constructing a directed node network associated with a plurality of accounts according to the fund flow direction among the plurality of accounts;
and the division submodule is used for dividing the directed node network into a plurality of sub-networks according to a preset algorithm.
Optionally, the partitioning sub-module is specifically configured to assign a label to each node in the directed node network according to a preset rule;
iterating all nodes in the directed node network by adopting a label propagation algorithm, and obtaining a plurality of sub-networks after preset iteration conditions are met; all nodes in each sub-network have the same label.
In a third aspect, an embodiment of the present application provides an abnormal fund aggregation behavior detection apparatus, including: the system comprises a processor, a storage medium and a bus, wherein the storage medium stores machine readable instructions executable by the processor, when the abnormal fund accumulation behavior detection device runs, the processor is communicated with the storage medium through the bus, and the processor executes the machine readable instructions to execute the abnormal fund accumulation behavior detection method according to the first aspect.
In a fourth aspect, an embodiment of the present application further provides a storage medium, where the storage medium stores a computer program, and the computer program is executed by a processor to perform the method for detecting an abnormal fund aggregation behavior according to the first aspect.
The beneficial effect of this application is:
in the embodiment of the application, a directed node network associated with a plurality of accounts is constructed, and nodes in the directed node network are divided into a plurality of sub-networks according to a preset algorithm, wherein the directed node network comprises a plurality of nodes, each node corresponds to one account information, and directed edges in the directed node network are used for representing the fund flow direction between the connected nodes; and then, acquiring transaction weights between accounts corresponding to each node in the sub-network, and calculating the fund aggregation degree of each node in the sub-network according to the transaction weights between the accounts corresponding to each node in the sub-network, so that whether a node with unbalanced fund flow direction exists in the sub-network can be judged according to the fund aggregation degree of each node in the sub-network, if the node with unbalanced fund flow direction exists, the account corresponding to each node in the sub-network can be considered to belong to an abnormal fund aggregation group, and the abnormal fund aggregation behavior detection aiming at the group property is realized.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are required to be used in the embodiments will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present application and therefore should not be considered as limiting the scope, and for those skilled in the art, other related drawings can be obtained from the drawings without inventive effort.
Fig. 1 is a schematic flowchart illustrating an abnormal fund aggregation behavior detection method provided in an embodiment of the present application;
fig. 2 illustrates a schematic diagram of directed node network partitioning provided in an embodiment of the present application;
FIG. 3 is another schematic flow chart diagram of an abnormal fund aggregation behavior detection method provided by an embodiment of the application;
FIG. 4 is a schematic flow chart diagram illustrating a method for detecting abnormal fund aggregation behavior provided by an embodiment of the present application;
FIG. 5 is a schematic flow chart diagram illustrating a method for detecting abnormal fund aggregation behavior provided by an embodiment of the present application;
fig. 6 is a schematic structural diagram illustrating an abnormal fund accumulation behavior detection apparatus provided in an embodiment of the present application;
fig. 7 shows a schematic structural diagram of a node network module provided in an embodiment of the present application;
FIG. 8 is a schematic structural diagram illustrating a first computing module provided in an embodiment of the present application;
fig. 9 is another schematic structural diagram of an abnormal fund accumulation behavior detection device provided in an embodiment of the present application;
fig. 10 shows a schematic structural diagram of an abnormal fund aggregation behavior detection apparatus provided in an embodiment of the present application.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are some embodiments of the present application, but not all embodiments. The components of the embodiments of the present application, as generally described and illustrated in the figures herein, could be arranged and designed in a wide variety of different configurations.
Thus, the following detailed description of the embodiments of the present application, as presented in the figures, is not intended to limit the scope of the claimed application, but is merely representative of selected embodiments of the application. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined and explained in subsequent figures.
In the description of the present application, it should be noted that the terms "first", "second", "third", etc. are used only for distinguishing the description, and are not intended to indicate or imply relative importance.
The embodiment of the application provides an abnormal fund aggregation behavior detection method which can effectively detect a group fund aggregation behavior.
Fig. 1 shows a flow chart of an abnormal fund accumulation behavior detection method provided in an embodiment of the present application.
As shown in fig. 1, the abnormal fund aggregation behavior detection method may include:
s101, constructing a directed node network associated with a plurality of accounts, and dividing nodes in the directed node network into a plurality of sub-networks according to a preset algorithm.
The directed node network comprises a plurality of nodes, each node corresponds to one account information, and directed edges in the directed node network are used for representing the fund flow direction between the connected nodes.
Optionally, the account may refer to a transaction account number, and a directed node network associated with the transaction account numbers may be constructed according to transaction data among the transaction account numbers. For example, a directed node network may be obtained by connecting nodes corresponding to transactions with a transaction account as a node and a direction of transferring out transaction funds (i.e., a fund flow direction) as a directed edge.
Fig. 2 shows a schematic diagram of directed node network partitioning provided in an embodiment of the present application.
As shown in fig. 2, a in fig. 2 illustrates a directed node network associated with a plurality of accounts, and each circle in fig. 2(a) is used as a node in the directed node network and can be used for representing an account for conducting a transaction; the directional edge with the arrow is used for indicating that the transaction is performed between the accounts respectively corresponding to the two connected nodes, and the arrow direction is used for indicating the fund flow direction of the transaction. For example, if there is a directed edge between node A and node B pointing from A to B, it indicates that account A's funds flow to account B.
Alternatively, a preset algorithm may be adopted to divide the nodes in the directional node network into a plurality of sub-networks. For example, after the directional node network shown in fig. 2(a) is divided by using a preset algorithm, the obtained multiple sub-networks may be as shown in fig. 2 (b).
The preset Algorithm may be a Community Detection (Community Detection) Algorithm, such as a Label Propagation Algorithm (LPA), a modularity-based Algorithm (Louvain), a spectral clustering Algorithm, and the like. The nodes in the directed node network may be divided into a plurality of sub-networks by a community discovery algorithm, i.e. all nodes in each sub-network constitute a community. For a node, the interaction between the node and nodes within the sibling community is tighter than the interaction between nodes outside the sibling community. That is, for each community (or sub-network), the transaction density between accounts corresponding to nodes in the community, such as: the transaction frequency, the fund weight and the like are larger than the transaction density between the account corresponding to the node in the community and the account corresponding to the node outside the community.
S102, acquiring transaction weights among accounts corresponding to the nodes in the sub-network.
Alternatively, the transaction weight may be an account and the number of funds between accounts. For example, if account a for node a transfers 10 ten thousand dollars to account B for node B, the transaction weight between account a and account B may be 10 ten thousand.
Optionally, the obtained transaction weight between the accounts corresponding to the nodes respectively may be directly marked in the sub-network; alternatively, the transaction weight between accounts corresponding to each node may be mapped to a directed edge in the subnetwork according to a certain proportional relationship, and the size of the transaction weight may be represented by the length of the directed edge, which is not limited in the present application.
It should be noted that, the step S102 may also be executed before the step S101, or the step S101 and the step S102 may also be parallel steps, and both the abnormal fund collection detection method provided in the embodiment of the present application may be implemented. When step S102 is executed first and step S101 is executed later, the transaction weights between the accounts corresponding to the nodes acquired in step S101 may be directly marked in the directed node network before the division. The sequence of step S101 and step S102 is not limited herein.
S103, calculating the fund aggregation degree of each node in the sub-network according to the transaction weight between accounts corresponding to each node in the sub-network.
The fund aggregation degree can measure the probability that any fund flows to each node finally when flowing in the transaction network. The larger the fund aggregation degree of the node is, the more easily funds are aggregated to the node in the transaction process, and the probability of the funds flowing to the node is higher.
After the fund aggregation degree of each node in the network is obtained through calculation, whether the corresponding node has a fund aggregation behavior or not can be obtained through analyzing the fund aggregation degree of each node in the sub-network, that is, whether the fund is collected into a few accounts in all the nodes in the sub-network can be obtained.
From the above, in the embodiment of the application, a directed node network associated with a plurality of accounts is constructed, and nodes in the directed node network are divided into a plurality of sub-networks according to a preset algorithm, wherein the directed node network comprises a plurality of nodes, each node corresponds to one account information, and directed edges in the directed node network are used for representing fund flow directions between the connected nodes; and then, acquiring transaction weights between accounts corresponding to each node in the sub-network, and calculating the fund aggregation degree of each node in the sub-network according to the transaction weights between the accounts corresponding to each node in the sub-network, so that whether a node with unbalanced fund flow direction exists in the sub-network can be judged according to the fund aggregation degree of each node in the sub-network, if the node with unbalanced fund flow direction exists, the account corresponding to each node in the sub-network can be considered to belong to an abnormal fund aggregation group, and the abnormal fund aggregation behavior detection aiming at the group property is realized.
Optionally, before determining whether the sub-networks have nodes with unbalanced fund flow direction according to the fund aggregation degree of each node in the sub-networks, the sub-networks with frequent transaction behaviors among the nodes may be screened from the plurality of sub-networks, and then, determining whether the sub-networks with frequent transaction behaviors among the nodes have the nodes with unbalanced fund flow direction according to the fund aggregation degree of the nodes, so that discovery of abnormal fund aggregation groups can be realized more efficiently, and more abnormal transactions and abnormal accounts can be discovered.
Fig. 3 shows another schematic flow chart of the abnormal fund aggregation behavior detection method provided in the embodiment of the present application.
Optionally, as shown in fig. 3, the constructing a directed node network associated with a plurality of accounts, and dividing the directed node network into a plurality of sub-networks according to a preset algorithm may include:
s301, acquiring a fund flow direction among a plurality of accounts.
S302, constructing a directed node network associated with the plurality of accounts according to the fund flow direction among the plurality of accounts.
As described above, the fund flow direction between multiple accounts may be acquired, the accounts serve as nodes, directed edges between the nodes are constructed in the direction indicated by the fund flow direction, and the multiple nodes are connected to obtain a directed node network.
Taking the node a and the node B as an example, if the flow direction of the funds between the account a corresponding to the node a and the account B corresponding to the node B is acquired is: and if the fund in the account A flows to the account B, a directed edge pointing from A to B can be constructed between the corresponding node A and the node B. Similarly, the nodes corresponding to the multiple accounts are connected by the directed edges according to the above manner, so as to obtain the directed node network associated with the multiple accounts.
And S303, dividing the directed node network into a plurality of sub-networks according to a preset algorithm.
Fig. 4 shows another schematic flow chart of the abnormal fund aggregation behavior detection method provided in the embodiment of the present application.
Optionally, as shown in fig. 4, the dividing the directed node network into a plurality of sub-networks according to the preset algorithm may include:
s401, endowing each node in the directed node network with a label according to a preset rule.
Optionally, the preset rule may refer to: each node in the network of directed nodes is given a unique label, i.e., each node has one and only one label.
S402, iterating all nodes in the directed node network by adopting a label propagation algorithm, and obtaining a plurality of sub-networks after preset iteration conditions are met.
After the directed node network is iterated through a label propagation algorithm, all the obtained nodes in each sub-network have the same label. In the process of iterating the nodes in the directed node network each time, each node can propagate the label of the node to the neighbor node, and in the directed node network, the neighbor node of a certain node refers to the node connected with the node through the directed edge. After each node receives the labels propagated by the neighbor nodes, the label with the highest occurrence frequency can be selected from the received labels to serve as a new label of the node.
For example, if the neighbor nodes of node a include: node B, node C, node D, node E, node F and node G; the labels of nodes a-G may be as shown in table 1 below:
TABLE 1
As can be seen from table 1, the neighbor nodes of node a propagate to node a in the label: the number of times of occurrence of the label "2" is 4, and the number of times of occurrence of the label "1" is 2, so that the node a may select the label "2" with the highest occurrence frequency as its new label, that is, after the iteration, the label of the node a is "2".
Optionally, for any node, if the node receives multiple (e.g., 2, 3, or more) labels with the highest frequency from the labels propagated by its neighboring nodes, the node may randomly select one of the multiple labels with the highest frequency as its new label.
Optionally, after the preset iteration condition is met, the preset iteration condition may indicate that each node in the directed node network acquires a label with the highest occurrence frequency in labels propagated by neighboring nodes, and iteration may be performed continuously by using a label propagation algorithm until each node acquires a label with the highest occurrence frequency in labels of neighboring nodes, and the iteration is stopped, so that nodes with the same label are divided into the same sub-network, and multiple sub-networks are obtained. Or, the preset iteration condition may also be a preset iteration number, and when the iteration of the tag propagation algorithm reaches the preset iteration number, the iteration may also be stopped, so as to obtain multiple subnetworks. Or, the preset iteration condition may also be a node that acquires a label with the highest occurrence frequency among labels propagated by neighboring nodes from all nodes in the directed node network, where the proportion of the label in all nodes reaches a preset threshold, for example: 90%, 95%, 99%, etc. In the embodiment of the present application, the preset iteration condition may be various, and the present application does not limit this.
As described above, in the process of iterative execution of the label propagation algorithm, the densely-related node clusters in the above-mentioned directed node network gradually converge to a sub-network with the same label because of mutual neighbor relationship, that is, the nodes with the same label in the sub-network may form a common community.
Optionally, in the convergence process, if different sub-networks are adjacent to a common node and a contention relationship is formed for the common node, the common node may select one sub-network from the different sub-networks as a sub-network to which the common node belongs according to the number of its neighboring nodes in the different sub-networks, the relationship weight between the common node and the neighboring node, and the like.
Also taking the node a as an example, if in the iterative process, both the sub-network P and the sub-network Q are adjacent to the node a, the sub-network P and the sub-network Q form a competitive relationship with the node a; neighbor nodes P1, P2 and P3 of the node A exist in the sub-network P, and neighbor nodes Q1, Q2 and Q3 of the node A exist in the node Q; the relationship weights between node A and the above-mentioned neighboring nodes P1, P2, P3, Q1, Q2 and Q3 (e.g., the relationship weights may be transaction weights as described in the previous embodiment) are shown in the following Table 2:
TABLE 2
| Neighbor node of node A | Relationship weight of node A and neighbor node |
| P1 | d1 |
| P2 | d2 |
| P3 | d3 |
| Q1 | d4 |
| Q2 | d5 |
| Q3 | d6 |
As shown in Table 2, it can be seen that:
sum S of relationship weights of neighbor nodes P1, P2, and P3 of node A in sub-network P p Comprises the following steps: s. the p ＝d1+d2+d3；
Sum S of relationship weights of neighbor nodes Q1, Q2, and Q3 of node A in sub-network Q Q Comprises the following steps: s. the Q ＝d4+d5+d6；
At this time, if S p ＞S Q Then node a may select sub-network P as its own home sub-network; if S p ＜S Q Then node a may select sub-network Q as its own home sub-network; if S p ＝S Q Node a may randomly select one of subnetwork P and subnetwork Q as its home subnetwork.
Fig. 5 shows another schematic flow chart of the abnormal fund aggregation behavior detection method provided in the embodiment of the present application.
Optionally, as shown in fig. 5, the calculating the fund aggregation level of each node in the sub-network according to the transaction weight between the accounts corresponding to each node in the sub-network may include:
s501, calculating fund transfer probability of each node in the sub-network relative to other neighbor nodes according to transaction weight among accounts corresponding to each node in the sub-network.
Optionally, the transaction weight between the accounts respectively corresponding to each node in the sub-network may be normalized to obtain the fund transfer probability of each node in the sub-network relative to other neighboring nodes.
The normalization process may be to map transaction weights between accounts corresponding to each node in the sub-network to 0-1.
For any node in the sub-network, the transfer-out amount of the account corresponding to the node to the account corresponding to each neighbor node can be calculated as the transaction weight of the node and all the neighbor nodes; then, the transaction weight of the node and each neighbor node can be normalized, and the obtained value is the fund transfer probability of the node relative to the neighbor node.
For example, assume that node a, and the neighbor nodes of node a, are present in the sub-network: the transaction weight from the node A to the node B is 50; the transaction weight from node a to node C is 100; then, the normalization process of the transaction weight of the node a and each neighboring node (B and C) may be:
50+100＝150；
50/150＝0.334；
100/150＝0.667；
namely, after normalization processing, the fund transfer probability of the node A relative to the node B is 0.334; the fund transfer probability of node a relative to node C is 0.667.
It should be noted that the fund transfer probability between the nodes corresponding to the transfer account and the non-transfer neighbor account is 0, that is, in the above example, the fund transfer probability of the node B or C with respect to the node a is 0.
S502, constructing a fund transfer matrix corresponding to the sub-network according to the fund transfer probability of each node in the sub-network relative to other neighbor nodes.
Optionally, the fund transfer probability of each node in the sub-network relative to other neighboring nodes obtained in step S501 above may be constructed as a fund transfer matrix M between nodes in the sub-network. In the matrix M, the numerical value corresponding to the ith row and the j column is M ij ，M ij And is used for expressing the fund transfer probability of the account corresponding to the node i to the account corresponding to the node j.
S503, calculating the fund aggregation degree of each node in the sub-network according to the page sorting algorithm and the fund transfer matrix corresponding to the sub-network.
Further, a page ranking (PageRank) algorithm can be adopted, the fund transfer probability matrix is used as input of the PageRank algorithm, the calculated PageRank value is an importance index of each node in the sub-network, and the importance index can be used as the fund aggregation degree of the corresponding node.
Optionally, after the fund aggregation degree of each node in the sub-network is calculated according to the transaction weight between the accounts corresponding to each node in the sub-network, the method for detecting abnormal fund aggregation behavior may further include:
and calculating and acquiring a balance index of the sub-network according to the fund aggregation degree of each node in the sub-network, wherein the balance index is used for indicating whether the fund aggregation degree distribution of each node in the sub-network is balanced or not.
Optionally, in this embodiment of the present application, the equalization index may be a kini coefficient or entropy. The value of the Gini coefficient is between 0 and 1, and the closer the Gini coefficient is to 0, the more balanced the fund aggregation degree distribution tends to; conversely, a closer the kini coefficient is to 1, the more the distribution of the fund aggregations tends to be unbalanced. The entropy is used as a measure of the degree of system disorder, and can also be used for measuring whether the fund aggregation degree distribution of each node in the sub-network is balanced or not, and if the entropy is larger, the fund aggregation degree distribution of each node in the sub-network is more disordered and unbalanced; conversely, the smaller the entropy, the more orderly and balanced the fund aggregation degree distribution of each node in the sub-network.
Optionally, if the balance index is a kini coefficient, the calculating the balance index of the sub-network according to the fund aggregation degree of each node in the sub-network may include:
using the formula
Calculating the Keyny coefficient of the sub-network;
wherein Gini represents a Gini coefficient, p j Indicating the fund collection of the jth node in the subnetwork.
The method for detecting the abnormal fund aggregation behavior has the advantages that the fund aggregation degree distribution of each node in the sub-network is measured by taking the keny coefficient as the balance index, and the efficiency of the method for detecting the abnormal fund aggregation behavior is higher due to the fact that the calculation speed of the computer, the processor and other computing equipment on the keny coefficient is higher.
Optionally, for the multiple sub-networks, if the calculated damping coefficient of a certain sub-network is greater than a preset damping coefficient threshold, for example, the damping coefficient threshold may be 0.5, 0.6, 0.8, and the like, it may be considered that an account corresponding to each node in the sub-network may be an abnormal fund aggregation group, and further, the accounts corresponding to each node in the sub-network may be checked, thereby effectively improving the checking efficiency on the abnormal fund aggregation group.
The embodiment of the present application provides still another abnormal fund collection behavior detection device, and fig. 6 shows a schematic structural diagram of the abnormal fund collection behavior detection device provided in the embodiment of the present application.
As shown in fig. 6, the abnormal fund accumulation behavior detection means may include: a node network module 10, an acquisition module 20 and a first calculation module 30; the node network module 10 is configured to construct a directed node network associated with multiple accounts, and divide nodes in the directed node network into multiple sub-networks according to a preset algorithm, where the directed node network includes multiple nodes, each node corresponds to one account information, and a directed edge in the directed node network is used to indicate a fund flow direction between the connected nodes; the obtaining module 20 is configured to obtain transaction weights between accounts corresponding to nodes in a sub-network; the first calculating module 30 is configured to calculate the fund aggregation level of each node in the sub-network according to the transaction weight between the accounts corresponding to each node in the sub-network.
Fig. 7 shows a schematic structural diagram of a node network module provided in an embodiment of the present application.
Optionally, as shown in fig. 7, the node network module 10 may include: obtaining a submodule 11, a constructing submodule 12 and a dividing submodule 13; the obtaining submodule 11 is used for obtaining the fund flow direction among a plurality of accounts; the construction submodule 12 is configured to construct a directed node network associated with a plurality of accounts according to a fund flow direction between the plurality of accounts; the dividing submodule 13 is configured to divide the directed node network into a plurality of sub-networks according to a preset algorithm.
Optionally, the partitioning submodule 13 may be specifically configured to assign a label to each node in the directed node network according to a preset rule; iterating all nodes in the directed node network by adopting a label propagation algorithm, and obtaining a plurality of sub-networks after preset iteration conditions are met; all nodes in each subnetwork have the same label.
Fig. 8 shows a schematic structural diagram of a first computing module provided in an embodiment of the present application.
Alternatively, as shown in fig. 8, the first calculating module 30 may include: a probability submodule 31, a matrix submodule 32 and an aggregation submodule 33; the probability submodule 31 is configured to calculate a fund transfer probability of each node in the sub-network relative to other neighboring nodes according to transaction weights between accounts corresponding to the nodes in the sub-network; the matrix submodule 32 is used for constructing a fund transfer matrix corresponding to the sub-network according to the fund transfer probability of each node in the sub-network relative to other neighbor nodes; the aggregation sub-module 33 is configured to calculate the fund aggregation of each node in the sub-network according to the page sorting algorithm and the fund transfer matrix corresponding to the sub-network.
Optionally, the probability submodule 31 may be specifically configured to perform normalization processing on transaction weights between accounts corresponding to each node in the sub-network, so as to obtain a fund transfer probability of each node in the sub-network with respect to other neighboring nodes.
Fig. 9 is a schematic structural diagram illustrating another abnormal fund aggregation activity detection apparatus provided in an embodiment of the present application.
Optionally, as shown in fig. 9, the abnormal fund accumulation behavior detection apparatus may further include: and a second calculating module 40, configured to calculate a balance index of the sub-network according to the fund aggregation degrees of the nodes in the sub-network, where the balance index is used to indicate whether the fund aggregation degree distribution of the nodes in the sub-network is balanced.
Optionally, the equalization index is a kuni coefficient or entropy.
Alternatively, if the equalization index is a kini coefficient, the second calculation module 40 may be specifically configured to use a formula
Calculating the Keyny coefficient of the sub-network; wherein Gini represents the Gini coefficient, p j Indicating the fund accumulation degree of the j-th node in the sub-network.
It can be clearly understood by those skilled in the art that, for convenience and brevity of description, the specific working process of the above-described abnormal fund accumulation behavior detection apparatus may refer to the corresponding process of the abnormal fund accumulation behavior detection method described in the foregoing method embodiment, and details are not described in this application.
An embodiment of the present application provides an abnormal fund accumulation behavior detection apparatus, and fig. 10 illustrates a schematic structural diagram of the abnormal fund accumulation behavior detection apparatus provided in the embodiment of the present application.
As shown in fig. 10, the abnormal fund aggregation activity detection apparatus may include: the system comprises a processor 100, a storage medium 200 and a bus (not shown), wherein the storage medium 200 stores machine-readable instructions executable by the processor 100, when the abnormal fund accumulation behavior detection device operates, the processor 100 communicates with the storage medium 200 through the bus, and the processor 100 executes the machine-readable instructions to perform the abnormal fund accumulation behavior detection method as described in the foregoing method embodiment. The specific implementation and technical effects are similar, and are not described herein again.
Embodiments of the present application further provide a storage medium, where a computer program is stored on the storage medium, and when executed by a processor, the computer program performs the method for detecting an abnormal fund aggregation behavior as described in the foregoing method embodiments. The specific implementation manner and the technical effect are similar, and are not described again here.
The above description is only a preferred embodiment of the present application and is not intended to limit the present application, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims (8)
1. An abnormal fund aggregation behavior detection method, comprising:
the method comprises the steps that a directed node network associated with a plurality of accounts is built, and nodes in the directed node network are divided into a plurality of sub-networks according to a preset algorithm, wherein the directed node network comprises a plurality of nodes, each node corresponds to one account information, and directed edges in the directed node network are used for expressing the fund flow direction between the connected nodes;
acquiring transaction weights among accounts corresponding to all nodes in the sub-network;
calculating the fund aggregation degree of each node in the sub-network according to the transaction weight between accounts corresponding to each node in the sub-network;
the calculating the fund aggregation degree of each node in the sub-network according to the transaction weight between the accounts corresponding to each node in the sub-network comprises the following steps:
calculating the fund transfer probability of each node in the sub-network relative to other neighbor nodes according to the transaction weight between accounts corresponding to each node in the sub-network;
constructing a fund transfer matrix corresponding to the sub-network according to the fund transfer probability of each node in the sub-network relative to other neighbor nodes;
calculating the fund aggregation degree of each node in the sub-network according to a page sorting algorithm and a fund transfer matrix corresponding to the sub-network;
after the calculating the fund aggregation degree of each node in the sub-network according to the transaction weight between the accounts corresponding to each node in the sub-network, the method further comprises the following steps:
calculating and acquiring a balance index of the sub-network according to the fund aggregation degree of each node in the sub-network, wherein the balance index is used for indicating whether the fund aggregation degree distribution of each node in the sub-network is balanced or not;
if the balance index is a kini coefficient, calculating the balance index of the sub-network according to the fund aggregation degree of each node in the sub-network, wherein the balance index of the sub-network comprises the following steps:
using a formula
Calculating the kini coefficients of the sub-networks;
wherein,
the coefficient of the kini is expressed,
represents the aboveWithin a sub-networkjThe degree of funds aggregation of the individual nodes.
2. The method of claim 1, wherein calculating the fund transfer probability of each node in the sub-network relative to other neighboring nodes according to the transaction weight between the accounts respectively corresponding to the nodes in the sub-network comprises:
and normalizing the transaction weight between the accounts corresponding to the nodes in the sub-network respectively to obtain the fund transfer probability of each node in the sub-network relative to other neighbor nodes.
3. The method of claim 1, wherein the equalization index is a kini coefficient or entropy.
4. The method of claim 1, wherein constructing a directed node network associated with a plurality of accounts and dividing the directed node network into a plurality of sub-networks according to a predetermined algorithm comprises:
obtaining a flow of funds between a plurality of accounts;
constructing a directed node network associated with the plurality of accounts according to the fund flow direction among the plurality of accounts;
and dividing the directed node network into a plurality of sub-networks according to a preset algorithm.
5. The method according to claim 4, wherein said dividing said directed node network into a plurality of sub-networks according to a predetermined algorithm comprises:
giving a label to each node in the directed node network according to a preset rule;
iterating all nodes in the directed node network by adopting a label propagation algorithm, and obtaining a plurality of sub-networks after preset iteration conditions are met; all nodes in each of the sub-networks have the same label.
6. An abnormal fund aggregation behavior detection apparatus, comprising:
the system comprises a node network module, a node network module and a node processing module, wherein the node network module is used for constructing a directed node network associated with a plurality of accounts and dividing nodes in the directed node network into a plurality of sub-networks according to a preset algorithm, the directed node network comprises a plurality of nodes, each node corresponds to one account information, and directed edges in the directed node network are used for representing fund flow directions between connected nodes;
the acquisition module is used for acquiring transaction weights among accounts corresponding to all nodes in the sub-network;
the first calculation module is used for calculating the fund aggregation degree of each node in the sub-network according to the transaction weight between accounts corresponding to each node in the sub-network;
the first computing module comprises:
the probability submodule is used for calculating the fund transfer probability of each node in the sub-network relative to other neighbor nodes according to the transaction weight between accounts corresponding to each node in the sub-network;
the matrix submodule is used for constructing a fund transfer matrix corresponding to the sub-network according to the fund transfer probability of each node in the sub-network relative to other neighbor nodes;
the aggregation sub-module is used for calculating the fund aggregation of each node in the sub-network by using a page sorting algorithm and a fund transfer matrix corresponding to the sub-network;
the abnormal fund aggregation behavior detection apparatus further includes: the second calculation module is used for calculating and obtaining a balance index of the sub-network according to the fund aggregation degree of each node in the sub-network, wherein the balance index is used for indicating whether the fund aggregation degree distribution of each node in the sub-network is balanced or not;
if the equalization index is a kini coefficient, the second calculation module is specifically configured to use a formula
Calculating the(ii) a kini coefficient of the subnetwork;
wherein,
the coefficient of the kini is expressed,
represents the first within the sub-networkjThe degree of funds aggregation of the individual nodes.
7. An abnormal fund aggregation behavior detection apparatus, comprising: a processor, a storage medium and a bus, the storage medium storing machine readable instructions executable by the processor, the processor and the storage medium communicating via the bus when the abnormal fund accumulation behavior detection apparatus is operated, the processor executing the machine readable instructions to perform the abnormal fund accumulation behavior detection method according to any one of claims 1 to 5.
8. A storage medium having stored thereon a computer program which, when executed by a processor, performs the abnormal fund aggregation behavior detection method according to any one of claims 1 to 5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910775437.5A CN110490730B (en) | 2019-08-21 | 2019-08-21 | Abnormal fund aggregation behavior detection method, device, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910775437.5A CN110490730B (en) | 2019-08-21 | 2019-08-21 | Abnormal fund aggregation behavior detection method, device, equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110490730A CN110490730A (en) | 2019-11-22 |
| CN110490730B true CN110490730B (en) | 2022-07-26 |
Family
ID=68552655
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910775437.5A Active CN110490730B (en) | 2019-08-21 | 2019-08-21 | Abnormal fund aggregation behavior detection method, device, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110490730B (en) |
Families Citing this family (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111161063A (en) * | 2019-12-12 | 2020-05-15 | 厦门市美亚柏科信息股份有限公司 | Capital account identification method based on graph calculation and computer readable storage medium |
| CN111291229B (en) * | 2020-01-21 | 2023-10-31 | 中国科学院计算技术研究所 | Method and system for detecting dense multi-part subgraphs |
| CN111445255A (en) * | 2020-03-11 | 2020-07-24 | 中国光大银行股份有限公司 | Method and device for determining abnormal fund transfer relationship |
| CN113011887B (en) * | 2021-03-10 | 2023-11-24 | 腾讯科技（深圳）有限公司 | Data processing method, device, computer equipment and storage medium |
| CN112927070A (en) * | 2021-04-21 | 2021-06-08 | 顶象科技有限公司 | Post-loan fund collection behavior scoring method and device |
| CN113204716A (en) * | 2021-05-26 | 2021-08-03 | 中国光大银行股份有限公司 | Suspicious money laundering user transaction relation determining method and device |
| CN113537960B (en) * | 2021-07-19 | 2024-08-06 | 中国工商银行股份有限公司 | Determination method, device and equipment for abnormal resource transfer link |
| CN113935832A (en) * | 2021-09-29 | 2022-01-14 | 光大科技有限公司 | Abnormal behavior detection processing method and device |
Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104199832A (en) * | 2014-08-01 | 2014-12-10 | 西安理工大学 | Financial network unusual transaction community finding method based on information entropy |
| CN104933570A (en) * | 2014-03-20 | 2015-09-23 | 阿里巴巴集团控股有限公司 | User detection method and device |
| CN107730262A (en) * | 2017-10-23 | 2018-02-23 | 阿里巴巴集团控股有限公司 | One kind fraud recognition methods and device |
| CN108228706A (en) * | 2017-11-23 | 2018-06-29 | 中国银联股份有限公司 | For identifying the method and apparatus of abnormal transaction corporations |
| CN108681936A (en) * | 2018-04-26 | 2018-10-19 | 浙江邦盛科技有限公司 | A kind of fraud clique recognition methods propagated based on modularity and balance label |
| CN109615524A (en) * | 2019-01-08 | 2019-04-12 | 平安科技（深圳）有限公司 | Recognition methods, device, computer equipment and the storage medium of crime of laundering clique |
| CN109934698A (en) * | 2019-01-29 | 2019-06-25 | 华融融通（北京）科技有限公司 | A kind of fraud related network feature extracting method propagated based on label |
| CN109948704A (en) * | 2019-03-20 | 2019-06-28 | 中国银联股份有限公司 | A kind of transaction detection method and apparatus |
| CN110032583A (en) * | 2019-03-12 | 2019-07-19 | 平安科技（深圳）有限公司 | A kind of recognition methods of fraud clique, device, readable storage medium storing program for executing and terminal device |
| CN110046929A (en) * | 2019-03-12 | 2019-07-23 | 平安科技（深圳）有限公司 | A kind of recognition methods of fraud clique, device, readable storage medium storing program for executing and terminal device |
Family Cites Families (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20160364794A1 (en) * | 2015-06-09 | 2016-12-15 | International Business Machines Corporation | Scoring transactional fraud using features of transaction payment relationship graphs |
| CN105931046A (en) * | 2015-12-16 | 2016-09-07 | 中国银联股份有限公司 | Suspected transaction node set detection method and device |
| CN107451157B (en) * | 2016-06-01 | 2020-12-18 | 阿里巴巴集团控股有限公司 | Abnormal data identification method, device and system, and searching method and device |
| CN110462612A (en) * | 2017-02-17 | 2019-11-15 | 凯恩迪股份有限公司 | The method and apparatus for carrying out machine learning using the network at network node with ageng and ranking then being carried out to network node |
| CN109146669A (en) * | 2018-08-24 | 2019-01-04 | 阿里巴巴集团控股有限公司 | Detection method, device and the server of abnormal funds transfer plan |
| CN110111110A (en) * | 2019-04-01 | 2019-08-09 | 北京三快在线科技有限公司 | The method and apparatus of knowledge based map detection fraud, storage medium |
-
2019
- 2019-08-21 CN CN201910775437.5A patent/CN110490730B/en active Active
Patent Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104933570A (en) * | 2014-03-20 | 2015-09-23 | 阿里巴巴集团控股有限公司 | User detection method and device |
| CN104199832A (en) * | 2014-08-01 | 2014-12-10 | 西安理工大学 | Financial network unusual transaction community finding method based on information entropy |
| CN107730262A (en) * | 2017-10-23 | 2018-02-23 | 阿里巴巴集团控股有限公司 | One kind fraud recognition methods and device |
| CN108228706A (en) * | 2017-11-23 | 2018-06-29 | 中国银联股份有限公司 | For identifying the method and apparatus of abnormal transaction corporations |
| CN108681936A (en) * | 2018-04-26 | 2018-10-19 | 浙江邦盛科技有限公司 | A kind of fraud clique recognition methods propagated based on modularity and balance label |
| CN109615524A (en) * | 2019-01-08 | 2019-04-12 | 平安科技（深圳）有限公司 | Recognition methods, device, computer equipment and the storage medium of crime of laundering clique |
| CN109934698A (en) * | 2019-01-29 | 2019-06-25 | 华融融通（北京）科技有限公司 | A kind of fraud related network feature extracting method propagated based on label |
| CN110032583A (en) * | 2019-03-12 | 2019-07-19 | 平安科技（深圳）有限公司 | A kind of recognition methods of fraud clique, device, readable storage medium storing program for executing and terminal device |
| CN110046929A (en) * | 2019-03-12 | 2019-07-23 | 平安科技（深圳）有限公司 | A kind of recognition methods of fraud clique, device, readable storage medium storing program for executing and terminal device |
| CN109948704A (en) * | 2019-03-20 | 2019-06-28 | 中国银联股份有限公司 | A kind of transaction detection method and apparatus |
Non-Patent Citations (1)
| Title |
|---|
| 基于特征向量中心度量的可疑洗钱识别算法;喻炜等;《电脑知识与技术》;20081125(第33期);第1466-1468页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110490730A (en) | 2019-11-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110490730B (en) | Abnormal fund aggregation behavior detection method, device, equipment and storage medium | |
| WO2019100967A1 (en) | Method and device for identifying social group having abnormal transaction activity | |
| US11636290B2 (en) | Systems and methods for determining features of entities based on centrality metrics of the entities in a knowledge graph | |
| WO2021254027A1 (en) | Method and apparatus for identifying suspicious community, and storage medium and computer device | |
| CN105335852B (en) | System and method for enhanced detection of fraudulent electronic transactions | |
| CN106067088A (en) | E-bank accesses detection method and the device of behavior | |
| CN107622072A (en) | A kind of recognition methods and server, terminal for web page operation behavior | |
| CN113689218A (en) | Risk account identification method and device, computer equipment and storage medium | |
| CN113537960B (en) | Determination method, device and equipment for abnormal resource transfer link | |
| CN113609345A (en) | Target object association method and device, computing equipment and storage medium | |
| Liu et al. | Heterogeneous graphs neural networks based on neighbor relationship filtering | |
| CN107527289A (en) | A kind of investment combination industry distribution method, apparatus, server and storage medium | |
| CN109741183A (en) | Information acquisition method and device | |
| CN112613762A (en) | Knowledge graph-based group rating method and device and electronic equipment | |
| CN109543959A (en) | Examine chain generation method, device, computer equipment and storage medium | |
| Wang et al. | Model for evaluating the enterprise financial performance with interval-valued intuitionistic uncertain linguistic information | |
| CN111242763A (en) | Method and device for determining target user group | |
| CN111161063A (en) | Capital account identification method based on graph calculation and computer readable storage medium | |
| Ullah et al. | Predicting Default Payment of Credit Card Users: Applying Data Mining Techniques | |
| CN116739605A (en) | Transaction data detection method, device, equipment and storage medium | |
| CN115239215A (en) | Enterprise risk identification method and system based on deep anomaly detection | |
| Zhu et al. | Building of safer urban hubs: Insights from a comparative study on cyber telecom scams and early warning design | |
| Yan et al. | The impact of capital market opening on stock market stability: Based on D-MST method complex network perspective | |
| CN114820215B (en) | Risk factor configuration method, device and equipment | |
| CN115730265A (en) | Anomaly identification method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |